version: 1.10

package pe

import "debug/pe"

Overview

Package pe implements access to PE (Microsoft Windows Portable Executable)
files.

Index

Package files

file.go pe.go section.go string.go symbol.go

Constants

  1. const (
  2.     IMAGE_FILE_MACHINE_UNKNOWN   = 0x0
  3.     IMAGE_FILE_MACHINE_AM33      = 0x1d3
  4.     IMAGE_FILE_MACHINE_AMD64     = 0x8664
  5.     IMAGE_FILE_MACHINE_ARM       = 0x1c0
  6.     IMAGE_FILE_MACHINE_EBC       = 0xebc
  7.     IMAGE_FILE_MACHINE_I386      = 0x14c
  8.     IMAGE_FILE_MACHINE_IA64      = 0x200
  9.     IMAGE_FILE_MACHINE_M32R      = 0x9041
  10.     IMAGE_FILE_MACHINE_MIPS16    = 0x266
  11.     IMAGE_FILE_MACHINE_MIPSFPU   = 0x366
  12.     IMAGE_FILE_MACHINE_MIPSFPU16 = 0x466
  13.     IMAGE_FILE_MACHINE_POWERPC   = 0x1f0
  14.     IMAGE_FILE_MACHINE_POWERPCFP = 0x1f1
  15.     IMAGE_FILE_MACHINE_R4000     = 0x166
  16.     IMAGE_FILE_MACHINE_SH3       = 0x1a2
  17.     IMAGE_FILE_MACHINE_SH3DSP    = 0x1a3
  18.     IMAGE_FILE_MACHINE_SH4       = 0x1a6
  19.     IMAGE_FILE_MACHINE_SH5       = 0x1a8
  20.     IMAGE_FILE_MACHINE_THUMB     = 0x1c2
  21.     IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x169
  22. )
  1. const COFFSymbolSize = 18

type COFFSymbol

  1. type COFFSymbol struct {
  2.     Name               [8]uint8
  3.     Value              uint32
  4.     SectionNumber      int16
  5.     Type               uint16
  6.     StorageClass       uint8
  7.     NumberOfAuxSymbols uint8
  8. }

COFFSymbol represents single COFF symbol table record.

func (*COFFSymbol) FullName

  1. func (sym *COFFSymbol) FullName(st StringTable) (string, error)

FullName finds real name of symbol sym. Normally name is stored in sym.Name, but
if it is longer then 8 characters, it is stored in COFF string table st instead.

type DataDirectory

  1. type DataDirectory struct {
  2.     VirtualAddress uint32
  3.     Size           uint32
  4. }

type File

  1. type File struct {
  2.     FileHeader
  3.     OptionalHeader interface{} // of type *OptionalHeader32 or *OptionalHeader64
  4.     Sections       []*Section
  5.     Symbols        []*Symbol    // COFF symbols with auxiliary symbol records removed
  6.     COFFSymbols    []COFFSymbol // all COFF symbols (including auxiliary symbol records)
  7.     StringTable    StringTable
  8.     // contains filtered or unexported fields
  9. }

A File represents an open PE file.

func NewFile

  1. func NewFile(r io.ReaderAt) (*File, error)

NewFile creates a new File for accessing a PE binary in an underlying reader.

func Open

  1. func Open(name string) (*File, error)

Open opens the named file using os.Open and prepares it for use as a PE binary.

func (*File) Close

  1. func (f *File) Close() error

Close closes the File. If the File was created using NewFile directly instead of
Open, Close has no effect.

func (*File) DWARF

  1. func (f *File) DWARF() (*dwarf.Data, error)

func (*File) ImportedLibraries

  1. func (f *File) ImportedLibraries() ([]string, error)

ImportedLibraries returns the names of all libraries referred to by the binary f
that are expected to be linked with the binary at dynamic link time.

func (*File) ImportedSymbols

  1. func (f *File) ImportedSymbols() ([]string, error)

ImportedSymbols returns the names of all symbols referred to by the binary f
that are expected to be satisfied by other libraries at dynamic load time. It
does not return weak symbols.

func (*File) Section

  1. func (f *File) Section(name string) *Section

Section returns the first section with the given name, or nil if no such section
exists.

type FileHeader

  1. type FileHeader struct {
  2.     Machine              uint16
  3.     NumberOfSections     uint16
  4.     TimeDateStamp        uint32
  5.     PointerToSymbolTable uint32
  6.     NumberOfSymbols      uint32
  7.     SizeOfOptionalHeader uint16
  8.     Characteristics      uint16
  9. }

type FormatError

  1. type FormatError struct {
  2. }

FormatError is unused. The type is retained for compatibility.

func (*FormatError) Error

  1. func (e *FormatError) Error() string

type ImportDirectory

  1. type ImportDirectory struct {
  2.     OriginalFirstThunk uint32
  3.     TimeDateStamp      uint32
  4.     ForwarderChain     uint32
  5.     Name               uint32
  6.     FirstThunk         uint32
  7.     // contains filtered or unexported fields
  8. }

type OptionalHeader32

  1. type OptionalHeader32 struct {
  2.     Magic                       uint16
  3.     MajorLinkerVersion          uint8
  4.     MinorLinkerVersion          uint8
  5.     SizeOfCode                  uint32
  6.     SizeOfInitializedData       uint32
  7.     SizeOfUninitializedData     uint32
  8.     AddressOfEntryPoint         uint32
  9.     BaseOfCode                  uint32
  10.     BaseOfData                  uint32
  11.     ImageBase                   uint32
  12.     SectionAlignment            uint32
  13.     FileAlignment               uint32
  14.     MajorOperatingSystemVersion uint16
  15.     MinorOperatingSystemVersion uint16
  16.     MajorImageVersion           uint16
  17.     MinorImageVersion           uint16
  18.     MajorSubsystemVersion       uint16
  19.     MinorSubsystemVersion       uint16
  20.     Win32VersionValue           uint32
  21.     SizeOfImage                 uint32
  22.     SizeOfHeaders               uint32
  23.     CheckSum                    uint32
  24.     Subsystem                   uint16
  25.     DllCharacteristics          uint16
  26.     SizeOfStackReserve          uint32
  27.     SizeOfStackCommit           uint32
  28.     SizeOfHeapReserve           uint32
  29.     SizeOfHeapCommit            uint32
  30.     LoaderFlags                 uint32
  31.     NumberOfRvaAndSizes         uint32
  32.     DataDirectory               [16]DataDirectory
  33. }

type OptionalHeader64

  1. type OptionalHeader64 struct {
  2.     Magic                       uint16
  3.     MajorLinkerVersion          uint8
  4.     MinorLinkerVersion          uint8
  5.     SizeOfCode                  uint32
  6.     SizeOfInitializedData       uint32
  7.     SizeOfUninitializedData     uint32
  8.     AddressOfEntryPoint         uint32
  9.     BaseOfCode                  uint32
  10.     ImageBase                   uint64
  11.     SectionAlignment            uint32
  12.     FileAlignment               uint32
  13.     MajorOperatingSystemVersion uint16
  14.     MinorOperatingSystemVersion uint16
  15.     MajorImageVersion           uint16
  16.     MinorImageVersion           uint16
  17.     MajorSubsystemVersion       uint16
  18.     MinorSubsystemVersion       uint16
  19.     Win32VersionValue           uint32
  20.     SizeOfImage                 uint32
  21.     SizeOfHeaders               uint32
  22.     CheckSum                    uint32
  23.     Subsystem                   uint16
  24.     DllCharacteristics          uint16
  25.     SizeOfStackReserve          uint64
  26.     SizeOfStackCommit           uint64
  27.     SizeOfHeapReserve           uint64
  28.     SizeOfHeapCommit            uint64
  29.     LoaderFlags                 uint32
  30.     NumberOfRvaAndSizes         uint32
  31.     DataDirectory               [16]DataDirectory
  32. }

type Reloc

  1. type Reloc struct {
  2.     VirtualAddress   uint32
  3.     SymbolTableIndex uint32
  4.     Type             uint16
  5. }

Reloc represents a PE COFF relocation. Each section contains its own relocation
list.

type Section

  1. type Section struct {
  2.     SectionHeader
  3.     Relocs []Reloc
  4.  
  5.     // Embed ReaderAt for ReadAt method.
  6.     // Do not embed SectionReader directly
  7.     // to avoid having Read and Seek.
  8.     // If a client wants Read and Seek it must use
  9.     // Open() to avoid fighting over the seek offset
  10.     // with other clients.
  11.     io.ReaderAt
  12.     // contains filtered or unexported fields
  13. }

Section provides access to PE COFF section.

func (*Section) Data

  1. func (s *Section) Data() ([]byte, error)

Data reads and returns the contents of the PE section s.

func (*Section) Open

  1. func (s *Section) Open() io.ReadSeeker

Open returns a new ReadSeeker reading the PE section s.

type SectionHeader

  1. type SectionHeader struct {
  2.     Name                 string
  3.     VirtualSize          uint32
  4.     VirtualAddress       uint32
  5.     Size                 uint32
  6.     Offset               uint32
  7.     PointerToRelocations uint32
  8.     PointerToLineNumbers uint32
  9.     NumberOfRelocations  uint16
  10.     NumberOfLineNumbers  uint16
  11.     Characteristics      uint32
  12. }

SectionHeader is similar to SectionHeader32 with Name field replaced by Go
string.

type SectionHeader32

  1. type SectionHeader32 struct {
  2.     Name                 [8]uint8
  3.     VirtualSize          uint32
  4.     VirtualAddress       uint32
  5.     SizeOfRawData        uint32
  6.     PointerToRawData     uint32
  7.     PointerToRelocations uint32
  8.     PointerToLineNumbers uint32
  9.     NumberOfRelocations  uint16
  10.     NumberOfLineNumbers  uint16
  11.     Characteristics      uint32
  12. }

SectionHeader32 represents real PE COFF section header.

type StringTable

  1. type StringTable []byte

StringTable is a COFF string table.

func (StringTable) String

  1. func (st StringTable) String(start uint32) (string, error)

String extracts string from COFF string table st at offset start.

type Symbol

  1. type Symbol struct {
  2.     Name          string
  3.     Value         uint32
  4.     SectionNumber int16
  5.     Type          uint16
  6.     StorageClass  uint8
  7. }

Symbol is similar to COFFSymbol with Name field replaced by Go string. Symbol
also does not have NumberOfAuxSymbols.